Vulnerability GHSA-gv3v-2cpp-3pmq
Medium Risk
MEDIUM RISK
CVSS Score: 5.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
8 months ago
February 10, 2026 at 12:30 PM UTC
Keycloak logs sensitive headers
12.0.0 - 26.5.5
12.0.0 - 26.5.5
Summary
Keycloak logs sensitive headers
Details
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Patches are available, see:
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
9 months ago
Keycloak has an improper input validation vulnerability
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
Low Risk
11 months ago
Keycloak unable to restrict access to the admin console
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
Medium Risk
1 year ago
Keycloak on Quarkus CLI option for encrypted JGroups ignored
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
Medium Risk
1 year ago
Denial of Service in Keycloak Server via Security Headers
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
Medium Risk
1 year ago
Keycloak allows unrestricted admin use of system and environment variables
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
Impacted packages
Timeline
Published
8 months ago
February 10, 2026 at 12:30 PM UTC
Fixed (26.5.6)
Unknown
Unknown
Last Modified
6 hours ago
October 30, 2026 at 09:45 PM UTC